POLICY
Require an Owner tag
Require a known, nonempty Owner tag on planned EC2 instances.
Policy reason
Managed EC2 instances require a known nonempty Owner tag
policy.d/terraform-require-owner-tag.yaml
apiVersion: atmos/v1
kind: Policy
metadata:
name: terraform-require-owner-tag
description: "Require a known, nonempty Owner tag on planned EC2 instances."
spec:
policies:
require-owner-tag:
on: terraform.plan
action: deny
reason: Managed EC2 instances require a known nonempty Owner tag
rule: >-
has(input.resource_changes) && input.resource_changes.exists(r,
r.mode == 'managed' && r.type == 'aws_instance' && r.change.after != null &&
(!has(r.change.after.tags) || r.change.after.tags == null ||
!has(r.change.after.tags.Owner) || r.change.after.tags.Owner == null ||
r.change.after.tags.Owner == '' ||
(has(r.change.after_unknown.tags) &&
(r.change.after_unknown.tags == true ||
(has(r.change.after_unknown.tags.Owner) && r.change.after_unknown.tags.Owner == true)))))
1 Configure
None. The tag key is Owner and is case-sensitive.
Only EC2 instances are selected. Deleting an instance is permitted.
2 Save
Save the CEL policy as policy.d/terraform-require-owner-tag.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
